This invention relates to the field of systems analysis, and in particular to a method and system for synchronizing records of packet transactions among multiple communications devices.
As the complexity of computer and communication networks continually increases, the need for tools and methods for effectively and efficiently analyzing the performance of such networks also increases.
Traffic monitoring devices, commonly called “sniffers”, have been used for many years to facilitate the diagnosis of communication problems and anomalies. Such monitors provide a record of all of the messages/packets that arrive or depart via a communication channel of a communications device to which they are attached. These monitors also typically record the state of the communication channel. The record, “log”, or “trace” of received or transmitted packets and the ongoing state of the communication channel often provides diagnostic insight into the operation of the communications device and/or the communication channel to which it is attached.
As used herein, the term “communications device” encompasses any device that transmits or receives signals from another device, and includes terminal devices, such as a computer or other device that originates transmissions or absorbs receptions, as well as a relay device, such as a router or other device that receives information from one device and forwards the information to another device, as well as a processing device that receives information from one device and forwards other information, based on the received information, to the originating device or another device.
Network analysis systems, which may include a network simulator, a queuing model system, and the like, are commonly used to analyze the performance of a network that includes the communication channels between and among the aforementioned communications devices. Typically, such network analysis systems require a model of a given network, as well as the performance characteristics of the devices and communication paths that form the network. A significant characteristic of a communication path is the delay that is incurred as a message travels along the path; such delay may include transmission, processing, congestion, and other delays that are introduced along the path. If each of the devices along a path, and each of the links between devices along the path, are accurately characterized, an accurate estimate of the time it may take to send a message from any device on the path to any other device on the path can be determined. Consider, for example, sending a request from a client device to a server for information that is contained in a remote database. The expected time between sending the request and receiving the information can be determined based on the cumulative processing time at each node in the path of the request and response, and the cumulative propagation time for communicating the information between each of the nodes in the path of the request and response.
Of particular note in this invention are the propagation time delays between transmitting an item from one device and receiving the item at another device. Although systems and devices are available for monitoring communication traffic at each node in a network, the determination of the difference in the time of transmission from a source and the time of receipt at a destination requires that the clocks at the source and the destination have a common time base. The problem of determining propagation time delays is further complicated by increasingly common use of firewalls and other message buffering schemes that effectively isolate sub-networks within a network, thereby disassociating the time bases in each sub-network.
It is an object of this invention to provide a system and method for determining a correspondence among clocks in a multi-node system. It is a further object of this invention to provide a system and method for determining the correspondence among clocks in a multi-node system based on independently monitored traffic at each node. It is a further object of this invention to provide a system and method for associating disassociated time bases in a network. It is a further object of this invention to provide a system and method that provides accurate/feasible estimates of propagation delay times between nodes in a system.
These objects, and others, are achieved by a system and method that iteratively propagates timing constraints among a plurality of nodes in a network, and determines a common time base among the nodes that conforms to these constraints. “Trace” files record the time of transmission or reception of packets at each node, based on a time base at the node. A fundamental constraint in a common time-based system is that the time of reception of a packet at a destination node cannot be prior to the time of transmission of the packet from a source node. A further constraint in a common time-based system is that the time of reacting to an event cannot be prior to the time of the event. By concurrently tracing traffic among multiple nodes in a network and subsequently processing the trace files to assure that each packet's transmission occurs prior to its reception, and that each reaction packet occurs after its corresponding causal packet, a correspondence between each node's time base and the common time base can be determined.
Throughout the drawings, the same reference numerals indicate similar or corresponding features or functions.